Prohibited Subtrees

A prohibited subtree is a branch of the allowed subtree that cannot
be accessed by the client. The base DN of a prohibited subtree must be subordinate
to the minimum base DN of an allowed subtree. If a client performs an operation
that is targeted at a prohibited subtree, the operation is denied.